Description
To specify password maximum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line:
A value of 180 days is sufficient for many environments.
The DoD requirement is 60.
The profile requirement is 365.
Rationale
Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}\n' 'login' 2>/dev/null | grep -q installed; then
var\_accounts\_maximum\_age\_login\_defs='365'
grep -q ^PASS\_MAX\_DAYS /etc/login.defs && \
sed -i "s/PASS\_MAX\_DAYS.\*/PASS\_MAX\_DAYS $var\_accounts\_maximum\_age\_login\_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
echo "PASS\_MAX\_DAYS $var\_accounts\_maximum\_age\_login\_defs" >> /etc/login.defs
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
